which was a for-profit entity subject to S-OX, than at the other three institutions which were not directly subject to SOX.It also reflects the fact that the depth of the relationship between the internal audit and information systems functions was not very strong at Institution B, where internal audit reported directly to the Board
of Regents and did not have a formal channel to communicate with the information
systems function